26fb989de7b66a4b008b3ed55aec1b80377cab3b33fa140bc33a9b99d660ea6e

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DayZHack.exe
Size

23KB
MD5

6b7a7fe2cf6a7303f979c7ce65cf76d4
SHA1

dec2f990ee557ab2b6034150758765bba1fbf919
SHA256

43aef564701c23676f071695bb0c91764ae9a23b1b50c07cd563b3124aea2b14
SHA512

c71bae5d44fe58f07ec86728f2ba8524d0a010f73006ef5cb793a9268fec6e32043d7d433db1c014754a52a04b394ec41d563257c81e3f93b7c8b97e8c69d591
SSDEEP

384:gtw7msNtEe7qA/D1naF7KHuFVGZLf45so6nJQfjS8djbhrCzYcHe+mh:gtw7msNtEe7qA71aF+Fdlo6nEZezYcHu

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	DayZHack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	DayZHack.exe

C:\Users\Admin\AppData\Local\Temp\DayZHack.exe
"C:\Users\Admin\AppData\Local\Temp\DayZHack.exe"
1⤵
- Checks processor information in registry
PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-0-0x000000001B2A0000-0x000000001B346000-memory.dmp

Filesize
664KB

Download
memory/980-1-0x00007FFBB2110000-0x00007FFBB2AB1000-memory.dmp

Filesize
9.6MB

Download
memory/980-3-0x000000001B820000-0x000000001BCEE000-memory.dmp

Filesize
4.8MB

Download
memory/980-2-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

Filesize
64KB

Download
memory/980-4-0x000000001BDD0000-0x000000001BE6C000-memory.dmp

Filesize
624KB

Download
memory/980-5-0x00007FFBB2110000-0x00007FFBB2AB1000-memory.dmp

Filesize
9.6MB

Download
memory/980-7-0x000000001BF30000-0x000000001BF7C000-memory.dmp

Filesize
304KB

Download
memory/980-6-0x0000000000C70000-0x0000000000C78000-memory.dmp

Filesize
32KB

Download
memory/980-8-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

Filesize
64KB

Download
memory/980-10-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

Filesize
64KB

Download
memory/980-9-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

Filesize
64KB

Download
memory/980-11-0x00007FFBB2110000-0x00007FFBB2AB1000-memory.dmp

Filesize
9.6MB

Download
memory/980-12-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

Filesize
64KB

Download
memory/980-14-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

Filesize
64KB

Download
memory/980-13-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

Filesize
64KB

Download